PT-2026-72126

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description Red Hat Quay contains flaws in the validation of JSON Web Tokens JWT used for single sign-on SSO authentication and federated robot accounts. The issues involve improper audience...

Insufficient Verification of Data Authenticity

Overview org.apache.cxf:cxf-rt-rs-security-sso-oidc is an Apache CXF Runtime OpenId Connect library. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the OIDC relying-party token validation process. An attacker can bypass authentication by...

CVE-2026-31625

A flaw was found in the Linux kernel's HID Human Interface Device alps driver. This vulnerability, a NULL pointer dereference, occurs because the driver attempts to process raw events without properly verifying if the device has been claimed. An attacker could potentially exploit this to cause a...

CVE-2026-31625 HID: alps: fix NULL pointer dereference in alps_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alpsrawevent Commit ecfa6f34492c "HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them" attempted to fix up the HID drivers that had missed the previous fix that was done i...

A grant cannot be removed if the user has already claimed/withdrawn all his tokens beforehand

Lines of code Vulnerability details The revokeGrant is used to removes a grant. Any available vested tokens will be sent to the grant recipient. Any remaining unvested tokens will be sent to the vesting manager. But in the case when the user has already claimed all his tokens, the revokeGrant wil...